ContactDiscoveryService VS simplexmq

[1] https://signal.org/blog/private-contact-discovery/

Signal uses SGX for remote attestation, which presumably lets the client verify that the code running on the server is a build of the OSS code and not a modified version. But I don't know the details or if this is reliable.

SGX and remote attestation described here:

https://signal.org/blog/private-contact-discovery/

Signal does private contact discovery and the effort they've gone to to do this is quite impressive.

TEEs have numerous privacy-enhancing applications that may benefit users. One of them is, as discussed earlier, private contact discovery; the Signal application uses a contact discovery service enhanced using Intel SGX, a TEE technology, to protect its users' privacy. A similar application of TEEs is performing malware analysis in a remote cloud service, so that the service may not identify users by the contents of their devices, such as the applications they have installed, especially important as 98.93% of users may be uniquely identified by the list of applications they have installed.

Signal (or, more accurately, one of its predecessors) used to use client-side private set intersection for contact discovery, but this scales poorly [1].

Now they use a solution based on Intel SGX and server-side trusted computing [2].

[1] https://signal.org/blog/contact-discovery/

[2] https://signal.org/blog/private-contact-discovery/

Of course https://github.com/simplex-chat/simplexmq

It's about ntf-server-ubuntu-20_04-x86-64 https://github.com/simplex-chat/simplexmq/releases/tag/v5.1.3

Also, it is covered in whitepaper here: https://github.com/simplex-chat/simplexmq/blob/stable/protocol/overview-tjr.md

Please review the whitepaper and / or website home page. I also wrote this post some time ago about why I believe that using pairwise identifiers should be a minimal requirement for a communication system to be considered private.

For more information see Simplex development roadmap xftp branch in github

The source code: https://github.com/simplex-chat/simplexmq/tree/xftp

You can download XFTP CLI (Linux) to send and receive files via the command line here - you need the file named xftp-ubuntu-20_04-x86-64, rename it to xftp.

We absolutely should assume they can be compromised, but as SimpleX servers do not participate in the initial key exchange for e2e encryption, the server compromise will not lead to the compromise of e2e encryption security. I wrote more on MITM issue in this post. Further, the threat model here explains other consequences of compromised SimpleX servers.